Policy Exceptions

Professional

Exceptions suppress a specific policy match when there's a legitimate business need. This guide covers what the shipped exception model does — and, importantly, what it does not do yet.

caution

Exceptions today are create-only. Once created, an exception cannot be listed, edited, or revoked from the product — there is no exceptions page, no per-policy exceptions tab, and no revoke action. Treat every exception as durable and record it outside the product (a ticket or change log) until management surfaces ship. Prefer a time-limited duration over Never expires for exactly this reason.

When to Use Exceptions

Exceptions are appropriate when:

• A user needs to discuss sensitive data for legitimate business reasons
• Test data triggers policies (for example, test credit-card numbers)
• A security team needs unrestricted access during an investigation

Exceptions are not appropriate for:

• Avoiding policies you disagree with
• Permanent workarounds (adjust the policy instead)
• Bypassing compliance requirements

Creating an Exception

Exceptions are created from the alert that was incorrectly triggered — that is the only entry point.

1. On the Alerts page, open the alert's ⋯ action menu (or open the alert's detail drawer)
2. Choose Create exception
3. Pick an exception type (below)
4. Choose a duration
5. Enter a justification (required, 20–500 characters)
6. Confirm

Creating exceptions requires a plan that includes exception workflows, plus permission to manage alerts. The control is hidden in view-only mode.

Exception Types

Type	What it matches
Exact	The specific matched value
Pattern	A pattern of values
Actor	The user who triggered the alert
Surface	The surface the alert came from

You can also apply the exception to similar alerts, and the exception records a back-reference to the alert it was created from.

note

The types are exact / pattern / actor / surface — not "user / team / pattern". An actor exception is the closest equivalent to a per-user exception, and a surface exception is stored at team scope.

Duration

Option	Effect
7 days / 30 days / 90 days	Expires automatically at the end of the window
Custom	Expires on a date you choose
Never expires	No expiry

Choosing Never expires, or a pattern or actor exception, triggers an extra confirmation step because those are the broadest options.

caution

Because exceptions cannot be revoked in-product today, a Never expires exception suppresses enforcement indefinitely. Use the shortest duration that meets the need.

Justification

A justification is required (20–500 characters) and is stored with the exception. Write it for a future reader who has no context:

• State the business need
• Reference a ticket or approval where one exists
• Note the expected end date

Approval Workflow (roadmap)

note

There is no approval workflow, approver queue, or multi-level approval, and exceptions carry no approval status. Any admin with the exception-workflow capability creates exceptions directly, with a confirmation step for the broadest options. If approval routing is a requirement for your deployment, contact your account manager.

Managing Exceptions (roadmap)

note

Viewing, filtering, editing, and revoking exceptions are not yet available: there is no Settings > Exceptions page, no per-policy Exceptions tab, and no revoke endpoint. Exception records do carry active and expiry fields, so time-limited exceptions lapse on schedule — but nothing in the product lists them or turns one off early. Until management surfaces ship, keep your own register of exceptions granted, and prefer short durations.

Auditing Exceptions

Exception creation is an administrator action recorded in your organization's audit trail — review it on the Activity page. Because in-product exception listing does not exist yet, the audit trail plus your own register are the record of what has been granted.

Best Practices

Justification

• Be specific about the business need
• Reference related tickets
• Include the expected end date

Duration

• Always prefer time-limited over Never expires
• Set realistic, short durations
• Re-create rather than extend

Scope

• Keep scope as narrow as possible
• Prefer Exact over Pattern
• Prefer a single Actor over a broad surface

Record-keeping

• Log every exception outside the product until management surfaces ship
• Re-review your register on a regular cadence

Troubleshooting

Exception not taking effect

1. Confirm the exception type matches what the policy actually matched
2. Confirm the exception has not expired
3. Confirm you created it against the right policy (exceptions are per policy)

Can't create an exception

1. Check that your plan includes exception workflows
2. Check you have permission to manage alerts (view-only mode hides the control)
3. Confirm your justification is at least 20 characters

Related Topics

• Policy Overview - How policies work
• Configuring Policies - Adjust policies instead of granting exceptions
• Managing Alerts - Where exceptions are created